CVE-2026-9435
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
A vulnerability was detected in the web management interface of Totolink A8000RU router, allowing OS command injection. The issue is in the setQosCfg function of /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
A remote attacker can gain full control over the device, compromising the confidentiality and integrity of data in the local network.
Recommendation
Immediately update the router firmware to the latest version or apply temporary firewall rules to block external access to the management interface.
Original NVD description (English source)
A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.